Authentication Bypass in Chatwoot via Direct Uploads

Executive Summary

CVE-2026-63765 is an authentication bypass vulnerability in Chatwoot versions before 4.16.0. It allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account by exploiting missing authentication checks in the direct uploads controller. Attackers can resolve accounts and conversations without credentials, obtain signed PUT URLs, and write arbitrary data to the application's storage backend.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Chatwoot instance is running a version before 4.16.0. Use commands like 'curl -s https://your-chatwoot-domain.com/api/version' or check the version in the admin panel. Additionally, monitor for unauthorized file uploads or unexpected storage activity in your storage backend (e.g., S3, GCS, or local disk).

Test the endpoint directly by sending a POST request to '/api/v1/accounts/:account_id/conversations/:conversation_id/direct_uploads' without authentication. A vulnerable system will return a 200 response with a signed upload URL, while a patched system should return a 401 error.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to upload arbitrary files to any tenant's storage, potentially leading to storage abuse, resource exhaustion, arbitrary file uploads, and database pollution. It occurs pre-authentication and cross-tenant, affecting deployments where storage serves trusted content.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access and storage. GDPR requires strict access controls and data protection measures, which are violated by this flaw allowing unauthenticated file uploads. HIPAA mandates safeguards for protected health information, which could be compromised if attackers upload malicious files to tenant storage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Chatwoot to version 4.16.0 or later. This version includes authentication checks for direct uploads, preventing unauthenticated access. Follow the official upgrade guide from Chatwoot's release notes or GitHub repository.

If upgrading is not immediately possible, restrict access to the vulnerable endpoint by implementing network-level controls (e.g., firewall rules) or temporarily disabling direct uploads until the upgrade is completed.

Useful 0 Not Useful 0